fix: 将 ARM64 wheel 纳入发布校验和上传流程

补齐全部架构的运行证据、GitHub 发布说明和 PyPI 逐文件下载核验。已通过 161 项测试、代码和文档门禁、九个 wheel 的本地索引下载核验，以及 ARM 三个 ABI 的 40 帧 CPU 检查。

build/README.md

@@ -73,8 +73,9 @@ and what to change before attempting to parallelize the per-ABI builds.
 
 ### Release gate
 
-Local only: never publishes, and makes no network call unless `--check-pypi` is
-passed. See `docs/publishing.md` for the full flow.
+Local only: never publishes. `--check-pypi` probes the index; native Windows
+venvs may download dependencies. Linux verification uses local Docker images
+and their offline wheelhouses. See `docs/publishing.en.md` for the full flow.
 
 ```bash
 python build/run.py release preflight --version <version>
@@ -91,6 +92,8 @@ is the expected input, so build first:
 
 ```bash
 python build/run.py wheel-win
+python build/run.py wheel-manylinux
+python build/run.py wheel-manylinux -Architecture aarch64
 python build/run.py release preflight --all-wheel-pythons --check-pypi
 ```
 
@@ -112,6 +115,10 @@ python build/run.py release pypi   --version <version> --pypi-only --apply
 
 Both refuse to act unless `release preflight` passed on a clean commit with no
 waived options, and every wheel still hashes to what that report recorded.
+Runtime evidence must cover every wheel hash. `--all-wheel-pythons` verifies all
+staged platforms and ABIs, using conda for Windows and matching Docker images for
+Linux. GitHub attaches all certified wheels; PyPI verifies every uploaded
+Python/platform wheel by downloading it and comparing its hash.
 Tokens are only ever read from a hidden prompt or stdin, never from argv.
 See `docs/publishing.md` §3.